CVE-2021-41500: High severity cvxpy vulnerability
Published Dec 17, 2021
·Updated
Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.
Affected Software
3 affected componentsFixes available
pip/cvxopt<1.2.7
1.2.7
Cvxopt Project Cvxopt Python<=1.2.6
Fedoraproject Fedora=34
Remediation
Patch Available
Event History
Dec 17, 2021
CVE Published
via MITRE·08:44 PM
Data Sourced
via MITRE·08:44 PM
Description
Jan 7, 2022
Advisory Published
via GitHub·12:01 AM
Sep 3, 2025
Data Sourced
via Microsoft·09:33 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-41500?
CVE-2021-41500 has a medium severity rating due to its potential to cause Denial of Service.
2
How do I fix CVE-2021-41500?
To fix CVE-2021-41500, upgrade the cvxopt package to version 1.2.7 or later.
3
Which versions of cvxopt are affected by CVE-2021-41500?
CVE-2021-41500 affects cvxopt versions up to 1.2.6.
4
Can CVE-2021-41500 be exploited remotely?
Yes, CVE-2021-41500 can be exploited remotely through the affected APIs to conduct Denial of Service attacks.
5
What software is vulnerable due to CVE-2021-41500?
CVE-2021-41500 affects the cvxopt library used in Python and specifically the associated APIs.